Infisical

Infisical lets you store API keys and database passwords in one place and pass them to your app as environment variables when it starts. Start by running it on your own computer with Docker Compose and storing only dummy values.

This review is for developers who keep secrets in .env files and want a safer setup. After reading it, you can do the following:

• Run Infisical on your own computer and store a dummy secret
• Start an app with the CLI and pass it the stored values as environment variables
• Use infisical scan to check a repository for leaked secrets

##What Infisical does

The official docs and README list these secrets management features:

• Per-environment secrets: Each project holds separate values for environments such as development and production. Every change creates a new version, and you can roll back to an earlier state
• Runtime delivery: Apps fetch secrets through the CLI, SDKs, agents, Kubernetes, or CI/CD. Infisical can also sync secrets to GitHub, Vercel, AWS Secrets Manager, and other platforms
• Rotation: Infisical replaces credentials, such as database credentials, with new values on a schedule
• Access control: Roles (RBAC) decide which values people and machine identities can read or change
• Audit logs: Infisical records who did what. The docs say this needs a Pro or higher paid plan, and self-hosted instances need an Enterprise license
• Secret scanning: Infisical can monitor GitHub, GitLab, and Bitbucket repositories, and the CLI can scan local files and Git history. CLI scans run locally and don’t need an Infisical login

The same platform also covers certificates, key management (KMS), and privileged access management.

Why this is safer than a .env file in the repository

The official docs describe Infisical Secrets Management as a replacement for .env files, hardcoded credentials, and secrets shared over channels such as Slack. They name committing a .env file and printing environment variables to a CI log as common ways secrets leak. With Infisical, the server stores the values encrypted, and the app receives only what it needs when it starts. You no longer keep a .env file next to your code, so there is nothing to commit by accident. Roles also limit who can read each environment.

##Infisical Cloud and self-hosting

You can use Infisical Cloud (app.infisical.com), run by the vendor, or run Infisical in your own environment. The docs say both offer the same core features. With the cloud version, the vendor handles upgrades and operations. When you self-host, you keep your own data, and you handle upgrades, monitoring, and backups. Self-hosting options include Docker, Docker Compose, Kubernetes, and a Linux package.

The license depends on the directory. Most of the repository is under the MIT license. The ee directories, which hold paid Enterprise features, use a separate Enterprise license that requires a valid subscription for production use. The license allows copying and modifying that code for development and testing without a subscription.

##Try it safely on your own computer

Don’t put real passwords or API keys in while you are trying it out. Use dummy values such as test-1234. The official Docker Compose setup is meant for trials and small deployments, not for high-availability production.

1. Install Docker and Docker Compose. The official minimum is 2 CPU cores, 4 GB of RAM, and 20 GB of disk.

2. In a working folder, download the Compose file and the settings file.

   curl -o docker-compose.prod.yml https://raw.githubusercontent.com/Infisical/infisical/main/docker-compose.prod.yml
   curl -o .env https://raw.githubusercontent.com/Infisical/infisical/main/.env.example

3. The ENCRYPTION_KEY and AUTH_SECRET in .env are sample values marked as unsafe for production. Even for a trial, replace them with values from openssl rand -hex 16 (ENCRYPTION_KEY) and openssl rand -base64 32 (AUTH_SECRET).

4. Start Infisical.

   docker compose -f docker-compose.prod.yml up -d

5. Open http://localhost:80 in a browser and create the admin account. The first user to sign up becomes the instance administrator, so do this before anyone else can reach it.

6. Create a project and add one dummy value, such as DUMMY_API_KEY, to the Development environment.

##Common tasks: pass values with the CLI

The CLI has official packages for each OS.

Check the install with infisical --version. Then use these commands:

CLI version 0.43.145 and earlier don’t have sm. Use infisical run instead of infisical sm run, or upgrade the CLI.

infisical scan finds leaks, like Gitleaks and TruffleHog do. Infisical’s secrets management keeps the values out of the repository to begin with, so using both covers prevention and detection.

##Cautions

##Read next

• cd ../gitleaksGitleaksfinds secrets that slipped into a repository
• cat ~/guides/lab-setup.mdHow to build a safe lab